AWS re:Invent 2016

As attackers become more sophisticated, web application developers need to constantly update their security configurations. Static firewall rules are no longer good enough. Developers need a way to deploy automated security that can learn from the application behavior and identify bad traffic patterns to detect bad bots or bad actors on the Internet. This session showcases some of the real-world customer use cases that use machine learning and AWS WAF (a web application firewall) with automated incident response and machine learning to automatically identify bad actors. We also present tutorials and code samples that show how customers can analyze traffic patterns and deploy new AWS WAF rules on the fly.

This session covers AWS Identity and Access Management (IAM) best practices that can help improve your security posture. We cover how to manage users and their security credentials. We also explain why you should delete your root access keys—or at the very least, rotate them regularly. Using common use cases, we demonstrate when to choose between using IAM users and IAM roles. Finally, we explore how to set permissions to grant least privilege access control in one or more of your AWS accounts.

This session covers what a real-world production deployment of a fully automated deployment pipeline looks like with instances that are deployed without SSH keys. By leveraging AWS CloudFormation along with Docker and AWS CodeDeploy, we show how we achieved semi-immutable and fully immutable infrastructures, and what the challenges and remediations were.

Whether it is per business unit or per application, many AWS customers use multiple accounts to meet their infrastructure isolation and billing requirements. In this session, we discuss considerations, limitations, and security patterns when building out a multi-account strategy. We explore topics such as identity federation, cross-account roles, consolidated logging, and account governance. Thomson Reuters also presents their approach to a multi-account strategy.

Now that you have decided to move forward with an AWS multi-account strategy, how should you help secure and manage your accounts? This session is a deep dive into some of the tools and processes that you can use to help ensure that you have a hardened blast radius between your AWS accounts while still being able to manage your security baseline across them. Some of the topics we cover are:

In this session, you’ll learn how to setup your AWS environment to avoid a cyber security attack and how to build a cloud specific incident response plan if your organization is breached. Cyber security expert and founder of Alert Logic Misha Govshteyn will share lessons learned from organizations that have protected themselves in AWS and from those that have been breached but quickly resolved their issues and implemented strong controls as a result. Joining Misha will be Sven Skoog, Senior Manager IT Security at Monotype who will discuss the cyber security posture they implemented within the AWS cloud and how they have built a robust process to ensure ongoing protection. Session sponsored by Alert Logic.

At re:Invent 2016, we are launching AWS Shield, a managed DDoS protection service. With AWS Shield, you can help protect Amazon CloudFront, Elastic Load Balancing, and Amazon Route 53 resources from DDoS attacks. In addition to introducing AWS Shield, this session presents some of the things we do behind the scenes to detect and mitigate Layer 3/4 network attacks and highlights ways you can use this new service to protect against Layer 7 application attacks.

AWS Organizations is a new administrative capability, which allows you to control multiple AWS accounts centrally. With Organizations, you can hierarchically organize and manage your AWS accounts and apply organizational controls across these accounts to meet your business needs. In this session, we cover the capabilities of AWS Organizations and discuss best practices when managing multiple AWS accounts.

With constantly evolving threats across the Internet, Harvard University deployed a security network platform to mitigate cyber threats, current and future, to protect institutional and research data. By using multiple geographic locations, best of breed equipment, and network automation, Harvard provides visibility, availability, and multilayer protections for their cloud network. This talk discusses the benefits, considerations, and lessons learned from using their security network platform at the edge of the cloud. Learn how Harvard designed and deployed the platform, utilizing serverless architecture to orchestrate the solution from within to protect their most sensitive data and afford students, faculty, and staff the flexibility of cloud computing.

Come to this session to learn how Europol, the Dutch police, Intel Security, and Kaspersky Lab have come together in an unprecedented collaboration of government and private-sector organizations. Open source ransomware code makes it easier to lock victims’ computers and encrypt their data, resulting in an alarming increase of cyber ransom. In response www.nomoreransom.org was created with the additional cooperation of AWS and Barracuda Web Application Firewall. Learn what tools are available to retrieve encrypted data and take a peek under the hood of this mission-critical website in the fight against ransomware. Perhaps because the site opposes ransomware, it has already received a number of attacks. Learn how AWS and Intel worked to rebuff these persistent assaults.